On Thu, 23 Oct 2003, Antony Stone wrote: > I don't see what use such a large quantity of log data would be put to in > order to make it worth keeping.
I do.. there is many situations where this is required. Several of the places I have been have as policy that proxy logs needs to be archived for a minimum of 6 months, with at least the last month kept online for fast searches if/when a abuse or security situation needs to be investigated. Some of these had rather large bandwidth, generating several GB of logs per day. Thankfully access logs can be compressed a lot making the long term archival not that cumbersome. Thankfully the place I was most involved with ran Squid on 64 bit hardware (Alpha), making the log file size a non-issue other than pure storage. Others have selected to rotate their logs on a hourly basis to keep the size down well below the magic 2GB. Regards Henrik
